Data Processing Agreement

1. Parties and Roles

For purposes of this DPA:

Customer means the organisation that has entered into the Agreement for use of IQounting.

IQounting means:

For Customer Personal Data processed under this DPA:

• the Customer acts as Controller or, where applicable, as Processor on behalf of another Controller; and
• IQounting acts as Processor or, where applicable, Subprocessor.

Each party shall comply with its respective obligations under applicable Data Protection Law.

2. Definitions

"Customer Personal Data" means Personal Data processed by IQounting on behalf of the Customer in connection with the Service.

"Data Protection Law" means Regulation (EU) 2016/679 ("GDPR") and other applicable EU or Member State data protection legislation.

"Personal Data", "Controller", "Processor", "Data Subject", "Processing", "Personal Data Breach" and "Supervisory Authority" have the meanings given to them in the GDPR.

"Subprocessor" means another Processor engaged by IQounting to process Customer Personal Data.

3. Scope of Processing

IQounting may process Customer Personal Data as necessary to:

• provide the Service;
• host and store Customer information;
• operate company workspaces;
• process invoices and accounting documents;
• process incoming bills and uploaded documents;
• perform OCR and AI-assisted document processing;
• create structured records from documents;
• provide invoicing functionality;
• operate integrations requested by the Customer;
• maintain and secure the Service;
• provide technical support;
• comply with documented Customer instructions; and
• comply with applicable law.

The Agreement, Customer configuration, use of Service functionality and other documented instructions from the Customer constitute processing instructions for purposes of this DPA.

4. Processing Details

5. Categories of Data Subjects

Depending on Customer use of the Service, Customer Personal Data may relate to:

• Customer personnel;
• authorised users;
• company representatives;
• customers;
• suppliers;
• vendors;
• contractors;
• sole traders;
• directors;
• business contacts;
• invoice recipients;
• payment recipients; and
• other natural persons identified in Customer records.

6. Categories of Personal Data

Customer Personal Data may include:

• names;
• business contact information;
• email addresses;
• telephone numbers;
• addresses;
• job titles;
• company affiliations;
• invoice data;
• supplier information;
• customer information;
• transaction information;
• bank account details;
• payment references;
• VAT-related information;
• contractual information;
• accounting information;
• document contents; and
• other information submitted by the Customer through the Service.

7. Special Categories of Personal Data

IQounting is not designed primarily for intentional processing of special categories of Personal Data within the meaning of Article 9 GDPR.

Special-category information may nevertheless appear incidentally within Customer documents.

The Customer is responsible for determining whether the submission and processing of such information is lawful and appropriate.

Customers should avoid uploading special-category Personal Data unless necessary for a legitimate purpose and supported by an appropriate legal basis.

8. Processing Instructions

IQounting shall process Customer Personal Data only:

• on documented instructions from the Customer;
• as necessary to perform the Agreement; or
• where required under Union or Member State law applicable to IQounting.

Where law requires processing outside Customer instructions, IQounting shall inform the Customer before carrying out such processing unless the applicable law prohibits such notice.

If IQounting reasonably believes that a Customer instruction infringes applicable Data Protection Law, IQounting may inform the Customer and suspend the relevant processing until the issue is resolved.

9. Customer Responsibilities

The Customer is responsible for:

• lawfulness of Customer Personal Data processing;
• establishing an appropriate lawful basis;
• providing required privacy information;
• determining the purposes of Customer-controlled processing;
• ensuring Customer instructions comply with Data Protection Law;
• limiting submitted information to what is reasonably necessary;
• managing authorised users;
• assigning appropriate access permissions;
• responding to Data Subject requests as Controller;
• determining appropriate retention requirements; and
• complying with applicable legal requirements concerning its accounting and business records.

10. Confidentiality

IQounting shall ensure that persons authorised to process Customer Personal Data are subject to appropriate confidentiality obligations.

Access to Customer Personal Data shall be limited to persons requiring access for purposes connected with providing, maintaining, securing or supporting the Service.

11. Security

Taking into account:

• the state of the art;
• implementation costs;
• the nature of processing;
• the scope and context of processing;
• the purposes of processing; and
• risks to the rights and freedoms of natural persons,

IQounting shall maintain appropriate technical and organisational measures designed to provide a level of security appropriate to the risk.

Such measures may include, where appropriate:

• encryption of communications;
• encryption of stored information where appropriate;
• authentication controls;
• role-based access controls;
• least-privilege access;
• infrastructure security;
• logging and monitoring;
• protected backups;
• recovery procedures;
• secure development measures;
• vulnerability management;
• incident response procedures;
• environment separation; and
• data minimisation.

Specific technical implementation may evolve as IQounting develops, provided that an appropriate level of protection is maintained.

12. Access Controls

IQounting shall restrict access to Customer Personal Data to authorised personnel and service providers who reasonably require such access.

Administrative access shall be appropriately restricted.

Customer account permissions remain under Customer control through available workspace functionality.

13. Personal Data Breaches

IQounting shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Personal Data.

To the extent reasonably available, IQounting shall provide information enabling the Customer to meet its obligations under Articles 33 and 34 GDPR.

Information may include:

• the nature of the Personal Data Breach;
• relevant categories of data;
• relevant categories of Data Subjects;
• likely consequences;
• measures taken or proposed to address the Personal Data Breach; and
• relevant contact information.

Where complete information is not immediately available, information may be provided in stages.

Notification of a Personal Data Breach does not constitute an admission of fault or liability by IQounting.

14. Data Subject Rights

Taking into account the nature of processing, IQounting shall provide reasonable assistance to the Customer in fulfilling applicable obligations relating to Data Subject rights.

If IQounting directly receives a request concerning Customer Personal Data for which the Customer acts as Controller, IQounting may direct the Data Subject to the relevant Customer unless prohibited by law.

IQounting shall not independently determine the outcome of such a request on behalf of the Customer.

15. Assistance with Data Protection Obligations

Taking into account the nature of processing and information reasonably available to IQounting, IQounting shall provide reasonable assistance to the Customer in relation to applicable obligations concerning:

• security of processing;
• notification of Personal Data Breaches;
• communication of Personal Data Breaches to affected individuals;
• Data Protection Impact Assessments where required; and
• prior consultation with a Supervisory Authority where required.

Such assistance shall be proportionate to the nature of the Service and IQounting's role as Processor.

16. Subprocessors

The Customer grants IQounting general written authorisation to engage Subprocessors where reasonably necessary to provide the Service.

IQounting shall maintain a current Subprocessor List describing the categories of relevant Subprocessors, and shall provide information about individual Subprocessors to the Customer where required under applicable Data Protection Law or upon reasonable request.

IQounting shall impose appropriate data protection obligations on Subprocessors that process Customer Personal Data.

IQounting remains responsible for its Subprocessors to the extent required by applicable Data Protection Law.

17. Changes to Subprocessors

Where required under applicable Data Protection Law, IQounting shall provide reasonable advance notice of intended additions or replacements of Subprocessors processing Customer Personal Data.

The Customer may object to a new Subprocessor on reasonable and documented grounds directly relating to data protection.

IQounting and the Customer shall attempt in good faith to resolve such objection.

Where no reasonable alternative is available, either party may terminate the affected Service in accordance with the Agreement.

An objection may not be used merely to avoid contractual or payment obligations unrelated to legitimate data protection concerns.

18. International Transfers

IQounting shall process international transfers of Customer Personal Data in accordance with applicable Data Protection Law.

Where required, an appropriate mechanism may include:

• an adequacy decision adopted by the European Commission;
• Standard Contractual Clauses;
• another lawful mechanism under Chapter V GDPR; and
• supplementary safeguards where appropriate.

Relevant Subprocessor processing regions and transfer mechanisms shall be identified where appropriate in the IQounting Subprocessor List or otherwise provided to the Customer where required under applicable Data Protection Law.

19. Standard Contractual Clauses

Where a transfer of Customer Personal Data requires the Standard Contractual Clauses adopted under European Commission Implementing Decision (EU) 2021/914, the applicable module shall apply to the relevant transfer.

Where IQounting acts as Processor and transfers Personal Data to a Subprocessor outside the EEA, the Processor-to-Processor module shall apply where appropriate.

The applicable transfer arrangements shall include the information required for lawful implementation of the Standard Contractual Clauses.

20. Requests from Public Authorities

Where legally permitted, IQounting shall seek to ensure that legally binding requests from public authorities concerning Customer Personal Data are appropriately limited to what is required by law.

Where legally permitted, IQounting may notify the Customer of such requests.

IQounting shall not voluntarily disclose Customer Personal Data to public authorities except where:

• authorised by the Customer;
• legally required; or
• otherwise permitted under applicable law.

21. Return and Deletion

Following termination of the Service, IQounting shall, subject to available functionality and applicable law:

• allow the Customer to retrieve or export Customer Personal Data where reasonably available; and/or
• delete Customer Personal Data.

Deletion may be subject to:

• backup lifecycle periods;
• legal retention requirements;
• security requirements; and
• technical limitations necessary for maintaining system integrity.

Customer Personal Data remaining solely in protected backups shall continue to be protected under this DPA until deletion or overwriting.

22. Compliance Information

IQounting shall make available to the Customer information reasonably necessary to demonstrate compliance with the Processor obligations applicable under Article 28 GDPR.

To the extent an inspection or other verification is specifically required under Article 28(3)(h) GDPR, IQounting shall comply with the requirements imposed by applicable Data Protection Law.

Any such activity shall be conducted in a manner that:

• protects the confidentiality and security of the Service;
• protects information concerning other Customers;
• avoids access to unrelated confidential information;
• does not unnecessarily interfere with Service operations; and
• is limited to what is reasonably necessary to demonstrate compliance with applicable Processor obligations.

Nothing in this Section requires IQounting to disclose:

• information relating to another Customer;
• trade secrets beyond what applicable law requires;
• source code;
• credentials;
• vulnerability information where disclosure would create a security risk; or
• information that IQounting is legally prohibited from disclosing.

23. AI and Automated Processing

IQounting may use AI, machine learning and OCR services in connection with Customer instructions.

Where a third-party AI or OCR provider processes Customer Personal Data on behalf of IQounting, the provider shall be treated as a Subprocessor where required by applicable Data Protection Law.

Customer Personal Data submitted to AI-assisted functionality shall be processed for purposes connected with providing and securing the Service and other purposes authorised under the Agreement and applicable law.

IQounting shall maintain appropriate contractual and technical safeguards relating to third-party AI providers.

IQounting does not authorise third-party AI providers to use Customer Personal Data for unrelated purposes or unrelated model training unless such use has been expressly disclosed and lawfully authorised.

24. Data Processing Locations

IQounting may use distributed cloud infrastructure and third-party service providers.

Subprocessing related information shall be indicated in the Subprocessors section.

IQounting may change infrastructure or processing locations as the Service evolves, provided applicable Data Protection Law continues to be observed.

25. Liability

Liability arising from this DPA is subject to the limitation of liability provisions of the Agreement to the maximum extent permitted by applicable law.

Nothing in this DPA excludes obligations or liabilities that cannot lawfully be excluded or limited.

26. Conflict

If this DPA conflicts with the Agreement concerning processing of Customer Personal Data, this DPA shall prevail to the extent of that conflict.

Where applicable Standard Contractual Clauses conflict with this DPA concerning an international transfer, the Standard Contractual Clauses shall prevail for the relevant transfer.

27. Term

This DPA becomes effective when the Customer becomes subject to the Agreement and remains effective for as long as IQounting processes Customer Personal Data on behalf of the Customer.

28. Governing Law

Unless mandatory Data Protection Law provides otherwise, this DPA is governed by the laws of the Republic of Estonia.

29. Contact

Annex I — Details of Processing

Annex II — Technical and Organisational Measures

IQounting shall maintain technical and organisational measures appropriate to the nature and risks of processing.

Measures may include, where appropriate:

• TLS or equivalent protection for data in transit;
• encryption of stored information where appropriate;
• secure authentication;
• role-based access controls;
• least-privilege access;
• environment separation;
• infrastructure access controls;
• protected backups;
• logging and security monitoring;
• secure software development practices;
• vulnerability management;
• incident response procedures;
• recovery procedures;
• data minimisation;
• confidentiality obligations;
• restrictions on production access; and
• appropriate controls concerning service providers.

Technical implementation may evolve as IQounting develops while maintaining a level of protection appropriate to the risks.

Annex III — Subprocessors

The categories of Subprocessors used by IQounting are published in the Subprocessors section, which forms part of this DPA.

Information about individual Subprocessors relevant to the Customer's use of the Service is provided where required under applicable Data Protection Law or upon reasonable request.